클라우드 컴퓨팅 환경에서의 디지털 증거 확보를 위한 소고

Abstract

It is necessary to have digital evidence to demonstrate crime cases, including both conventional forms of crime and cybercrime. However, it has become increasingly difficult for investigation agencies to gain digital evidence in the cloud computing environment. While criminals who are well aware of this investigative difficulty are hiding any (potential) evidence in the cloud, this fact is not considered seriously into the current criminal justice procedure. In the case of computer crime, it is possible to gain digital evidence by confiscating and searching hardware involved in crimes, but this way of investigation does not work anymore for cloud computing, big data, and virtualization technology. Although the amended criminal procedural legislations have been in effect to procure digital evidence since January 1st, 2012, it does not effectively handle the problem. Accordingly, the Ministry of Justice, Korea, is discussing about re-amending the legislations, but we, also, are to provide several ways to procure digital evidence in the cloud computing environment here in this paper. The existing criminal procedural law has not been able to provide a system in which confiscation and search on digital evidence is effectively carried out, probably because the system is not applicable to the cloud computing environment. Thus, it is highly necessary to seek for some ways to unable criminals to hide evidence in the cloud. There are varying opinions to deal with this matter, depending on scholars, but six main ways are presented in this paper. First, there need to be empirical studies which show the difficulty of procuring digital evidence. More importantly, the current warrant system should be improved, because a warrant is most needed when gaining evidence but the existing system still remains analogue while evidence has become digital. Another thing to be considered is that the perception on digital evidence of the court and investigation agencies is different, which put an obstacle to procure evidence in practice. As noted above, the amended legislations are not able to deal effectively with the problems, and it is not sufficient to confiscate and search to gain evidence in the cloud computing environment. Therefore, there should be an additional measure to gain evidence hid in the cloud. After following discussions, several ways, such as information submission order, a third party’s cooperative obligation, online search, etc., should be in consideration.